Using JENKINS_HTTPS_KEYSTORE_PASSWORD exposes keystore password in process list

This issue is archived. You can view it, but you can't modify it. Learn more

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Major
    • Component/s: packaging
    • Environment:
      Rocky Linux 9.3
      Jenkins 2.441 installed from RPM

      If Jenkins is installed from RPM and systemd unit has JENKINS_HTTPS_KEYSTORE_PASSWORD set, this exposes keystore password in the process list.

      https://www.jenkins.io/doc/book/installing/initial-settings/#miscellaneous-parameters talks about sensitive parameters, specifically about --httpsKeystorePassword, and recommends the use of --paramsFromStdIn
       but Jenkins' own systemd starter doesn't follow that.

      IMO, Jenkins systemd starter script should use --paramsFromStdIn if JENKINS_HTTPS_KEYSTORE_PASSWORD is set.

            Assignee:
            Unassigned
            Reporter:
            Vilius
            Archiver:
            Jenkins Service Account

              Created:
              Updated:
              Archived: